started-lives-wlt[.]pages[.]dev

PhishDestroy identifies started-lives-wlt.pages.dev as a live crypto drainer campaign targeting unsuspecting users. This malicious domain hosts a counterfeit login portal designed to trick visitors into surrendering wallet credentials or signing malicious transactions. Once accessed, the page silently initiates blockchain transactions to drain funds to attacker-controlled addresses. The threat remains undetected by security vendors, with VirusTotal currently showing 9/95 detections despite active hosting. This domain was flagged through Cloudflare’s Pages service, leveraging Google Trust Services for SSL encryption to appear legitimate. Registered via Cloudflare, Inc., the infrastructure resolves to IP 172.66.47.200, a known dynamic hosting range. While the exact creation date remains unverified, the absence of detections suggests a recently deployed campaign. The domain’s use of a .pages.dev subdomain mimics legitimate developer platforms, further lowering user suspicion. If you’ve visited started-lives-wlt.pages.dev, disconnect your wallet immediately and revoke any unauthorized permissions. Do not interact with wallet prompts from this domain. Report the incident to PhishDestroy and scan your device for malware. Avoid reopening the link; instead, verify legitimate sites via official channels. Stay vigilant—crypto drainers evolve rapidly, and undetected domains pose severe risks.